6b3e805ac2
Agent only ever runs a binary whose minisign signature verifies against
the EMBEDDED public key. NATS host.cmd func 'update' {url}: download
binary + .minisig from the CDN -> verify against embedded pubkey ->
atomic swap (.old rollback) -> relaunch. URL allowlist (https + cdn.
corrosionmgmt.com only, rejects userinfo-bypass), 100MiB cap. Closes the
supply-chain hole: even a malicious CDN upload can't run unsigned.
CI: build-host-agent.yml signs every artifact with MINISIGN_SECRET_KEY
(Gitea secret) and publishes .minisig alongside; the step FAILS the
build if the secret is absent (refuses to ship unsigned). Bumped to
alpha.6.
6 deterministic tests (accept valid / reject tampered+garbage+empty sig,
URL allowlist incl userinfo-bypass, atomic swap+rollback). Fixtures
signed with the real release key so tests need no key at runtime. Full
suite 50/50 green; musl + native build clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
42 lines
2.1 KiB
Markdown
42 lines
2.1 KiB
Markdown
# Corrosion Host Agent
|
|
|
|
Rust rewrite of the Go companion agent (`companion-agent/`, retained as the
|
|
behavior reference until parity). One agent per machine supervises every game
|
|
instance on that host — Rust, Conan Exiles, Soulmask, Dune: Awakening.
|
|
|
|
- **Wire protocol**: see [PROTOCOL.md](./PROTOCOL.md) (v2, instance-scoped subjects)
|
|
- **Config**: see [agent.example.toml](./agent.example.toml)
|
|
|
|
## Status — Phase 0
|
|
|
|
- [x] Multi-instance TOML config + env overrides (`CORROSION_LICENSE_ID`, `CORROSION_NATS_URL`, `CORROSION_NATS_TOKEN`)
|
|
- [x] NATS connection (infinite reconnect, capped backoff, 30s ping, offline send-buffering, `tls://` support)
|
|
- [x] Host heartbeat with real telemetry (sysinfo: CPU, memory, disks) — no fabricated values
|
|
- [x] Connectivity prober (outbound TCP, periodic + on-demand)
|
|
- [x] Host command channel (`ping`, `probe`, `sysinfo`)
|
|
- [x] Graceful shutdown (cancellation token, going-offline beacon, NATS flush)
|
|
- [x] Phase 1a: process supervision — per-instance start/stop/restart/status over
|
|
`{instance}.cmd` request-reply, push state events on `{instance}.status`,
|
|
crash detection with exit codes, live state in heartbeats
|
|
(integration-tested with real processes + live-NATS contract test)
|
|
- [ ] Phase 1b: RCON trait (WebRCON rust / TCP conan+soulmask), SteamCMD, jailed file manager
|
|
- [ ] Phase 2: Dune Docker adapter (compose lifecycle, RabbitMQ bus, Postgres admin)
|
|
- [x] Phase 3a: SIGNED self-update — minisign-verified download+swap+relaunch (NATS `update` func); embedded public key; CI signs releases
|
|
- [ ] Phase 3b: service install (systemd/SCM), PID adoption
|
|
|
|
## Build
|
|
|
|
```bash
|
|
cargo build --release # native
|
|
cargo build --release --target x86_64-unknown-linux-gnu # linux deploy target
|
|
cargo build --release --target x86_64-pc-windows-msvc # windows (cargo-xwin on non-Windows)
|
|
```
|
|
|
|
## Run
|
|
|
|
```bash
|
|
corrosion-host-agent --config ./agent.toml # foreground
|
|
corrosion-host-agent --config ./agent.toml check # validate config only
|
|
corrosion-host-agent version # semver + git hash + build ts
|
|
```
|